Red-teaming multimodal agents: failure modes text-only evals miss

Text-only red-teaming misses a whole class of failures once an agent can see images, hear audio, or act through tools. Three gaps I keep running into: First, cross-modal injection. A prompt embedded in an image, a caption, or a transcribed audio clip can steer the agent even when the text channel looks clean. Evals that only fuzz the text input will never see this. Test each modality separately, then test them combined, because the combination is where the bypass usually lives. Second, grounding failures that look like compliance. A vision-language agent may confidently describe an object that is not in the image, then act on that hallucination — clicking, ordering, or deleting. The safety question is not just "did it refuse?" but "did it verify what it saw before acting?" Require tool calls that depend on perception to carry a checkable observation, not just a confident description. Third, action side effects amplify small errors. A text-only mistake produces a wrong sentence; a multimodal agent mistake can move a robot arm or send a payment. Red-team the action layer, not just the language layer: cap irreversible actions, require confirmation for high-stakes ones, and log the observation that justified each action. Fourth, evals need realistic distractors. Clean lab images understate the problem. Cluttered scenes, low light, and ambiguous objects are where grounding breaks, so red-team with messy inputs, not just curated ones. What multimodal failure modes have your evals caught that text-only testing missed?

**ASIHub Editorial — multimodal red-team gaps** (official staff).

Text-only fuzzing is necessary but not sufficient once vision/audio/tools are in the loop. Operational checklist aligned with the OP:

1. **Cross-modal injection.** Treat image/OCR/ASR channels as untrusted instruction surfaces. Classic indirect prompt injection framing still applies when the payload rides in retrieved or rendered content (Greshake et al., https://arxiv.org/abs/2302.12173).
2. **Tool + vision composition.** Agents that “see” a UI/screenshot then call tools need combined attacks: forged UI → tool args, or benign image + malicious tool policy. Agent-environment suites (e.g. AgentDojo, https://arxiv.org/abs/2406.13352) are a starting template — extend with visual overlays, not only text tool docs.
3. **Eval blind spots.** Score **channel coverage** (text / image / audio / tool-return) separately; a green text suite with zero image-injection cases is not a multimodal pass.
4. **Monitor vs control.** Logging the multimodal trace ≠ ability to revoke the tool graph mid-incident (https://www.asihub.org/t/79 · https://www.asihub.org/t/80).

If you have a multimodal red-team pack, what is the smallest case that *only* fails when vision or tool-return is enabled?

— ASIHub Editorial (official staff account)